Sizing for malware scanning of MSDP backup image
This section outlines the methodology for sizing malware scan hosts when performing scans on backup images stored in MSDP storage. Proper sizing depends on several factors, including the nature and composition of the protected data, as well as the available spare IOPS capacity on the storage server where backup resides. The guidance provided here serves as a foundational framework for basic sizing considerations. For environment-specific sizing recommendations and advanced tuning, consult your Veritas account team or authorized reseller.
Key sizing parameters
Effective sizing for malware scan hosts requires answering several key questions related to the backup environment:
What type of data is being scanned? File types such as ZIP, image, or other archive formats require additional processing time, as contents must be extracted and individually scanned.
What is the volume and structure of the data? Understanding the total data size and the number of files per backup image is critical, as high file counts can significantly impact scan performance.
Where does the backup data reside? Identifying the specific storage server(s) used for scanning is essential.
Are multiple copies of the backup stored across different storage servers? This can influence scan strategy and scan host sizing.
What is the current load on the storage server? It's important to assess how many parallel scans the storage server can support to determine how many scan hosts are required.
The following formula can be used:
Number of scan hosts required = parallel scans limit set on storage server / optimal parallelization per scan host
As the number of parallel scans on a scan host increases, throughput improves. However, the percentage gain diminishes with each additional scan. Optimal parallelization is achieved at the point where the maximum number of parallel scans yields the highest throughput in terms of files scanned per hour.
Based on in-house testing, optimal parallelization per scan host is determined as follows:
Linux scan host with NFS share type can support upto 6 parallel scans
Windows scan host NFS/SMB share type can support upto 3 parallel scans
For example: If a storage server can support a maximum of 20 parallel scans at its current load, then:
Number of Linux scan hosts required = 20/6 ~ 4. Hence, 4 Linux scan hosts would suffice.
Number of Windows scan hosts required = 20/3 ~ 7. Hence, 7 Windows scan hosts would suffice
To estimate the scan duration for a given number of files, measure the scanning throughput using the current deployment. Trigger the maximum number of parallel scans configured per storage server to determine the effective throughput, expressed as the number of files scanned per hour.
The following formula can be used:
Expected time to scan (in hours) = (Number of backups * Average number of files in backup) / Throughput per hour.
For example: For a Linux scan host using NetBackup Malware Scanner and NFS share type
If throughput per hour = 12 million files per hour
Number of backups to scan = 100
Average number of files per backup = 500k
Expected time to scan (in hours) = (100 x 500,000 / 12,000,000) ~ 4 hours
In-house testing shows
Linux scan host using NetBackup Malware Scanner and NFS share type provides 4 times throughput compared to Windows scan host using NetBackup Malware scanner and NFS share type.
Throughput numbers for Standard/MS-Windows policy backup scans are 10 times more than VMWare VM backup scans. This difference can be attributed to the use of additional virtualization layer to mount virtual disk - while creating instant access of VM backup.